Hello. we have gotten a request by our security team to tighten up the access to the logs in our splunk deployment. currently we log everything into a limited amount of indexers based on what type of log it is. this means that for example all win_event logs are gathered together.  security has expressed an interest in restricting access to logs based on what service the host operates to the relevant users that are service operators. This isn't that much of an issue as we have other systems that has that info but that info is not present within splunk. so I've thought of a few things but don't quite know how to implement these. either restrict searches based on hosts through the role manager. but this seems messy as hosts change all the time and must be manually kept up to date (afaik) another way would be to tag the hosts, but how would I go about doing that. could that be done on the forwarder, can the indexer do that, how would i go about referencing outside systems for this info ( i do have the code to actually supply the info, just don't know where to put it). finally is there any way to do this retroactively? ... View more

hello, i'm looking into how to automate splunk setup for newly spun up servers. As i'm still not the most proficient with the splunk internal configs to determine whats needed and whats not i want some guidance as to which config files i need to alter in order to prepare the newly spun up server to be plugged into the wider splunk deployment. Currently we have a distributed multisite setup and the idea is to have a collection of the configs needed so that we can just alter and push them to the new server given the servers task, be it Indexer, search head or any other server we potentially need. So what i'm asking for is a pointer to which config files that needs to be staged for setup. ( I assume it's mostly the ../system/*.conf files but if there are any others to keep a look out for) ... View more

Hello. i've been looking around a bit but it appears my google-fu isnt up to snuff for this problem. i'm wondering how one can parse non-pure xml logs. as in we have a ".txt" file that timestamps, debug messages and all that jazz. but it also writes entire XML responses in the log file. i dont know if the source log is able to separate it out (doubt it) but the question goes as follows. i'm aware there is a XML parser for the props.conf. but does that work on intermittent xml formatted log entries? <date>,source,debug: event happened <date>,source,debug: function executed <date>,source,debug: send data to URI <date>,source,debug: multiline XML response <date>,source,log message the xml response can sometimes be longer than 1000 lines which is where the issue arrives, as we get an error due to the log entry being more than 1000 lines long. it's all the xml tags <meta> </meta> <link> </link> and the like. does props support something in the line of if XML do XML parsing else do normal props things or do I have to parse ell the XML response segments manually? ... View more